Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal • Hacker News Board

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#21

Post by khedoros1 » Fri, Jul 07, 2017, 7:52 PM UTC

pmoriarty wrote: post #14

fixermark wrote: post #11

Earlier quoted context omitted.

The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to…

"It's just the "Do you want to allow Flash to play this cool video?" story all over again." Another comparison to existing tech is Javascript. A lot of sites break if you disable Javascript in your browser, but if you enable it you open yourself to Javascript vulnerabilities.

Open browsers have open, auditable Javascript engines. There can be vulnerabilities, but you aren't waiting for some company to put out a closed patch containing a fix. EME blobs are like Flash plugin blobs.

So, it's similar in the sense that enabling JS increases the potential attack surface, just like installing EME/Flash/whatever does. But at least the JS engine can be examined by whoever wants to.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#22

Post by benchaney » Fri, Jul 07, 2017, 7:53 PM UTC

bcheung wrote: post #20

What's the reason DRM can't be implemented as an open-source solution? Is the closed source just to prevent people from easily accessing the secret key or are there other reasons it needs to be closed source?

DRM is fundamentally security by obscurity. Being closed source is the only way to maintain obscurity, and thus the illusion of security.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#23

Post by [deleted] » Fri, Jul 07, 2017, 7:53 PM UTC

bcheung wrote: post #20

What's the reason DRM can't be implemented as an open-source solution? Is the closed source just to prevent people from easily accessing the secret key or are there other reasons it needs to be closed source?

[deleted]

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#24

Post by gsnedders » Fri, Jul 07, 2017, 7:53 PM UTC

danudey wrote: post #15

fixermark wrote: post #11

Earlier quoted context omitted.

The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to…

Presumably they feel the same way about all closed-source browsers? Also, the comparison to Flash is not quite right. For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it. Web DRM, on the other hand, is a standard that allows for an encrypted video stream to be decrypted. The only differences that I can see between…

> For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it.

And, notably, the DRM modules can be sandboxed far more than Flash can.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#25

Post by kibwen » Fri, Jul 07, 2017, 8:03 PM UTC

asadotzler wrote: post #5

fixermark wrote: post #3

Ultimately, the actual standard of the web is the behavior implemented by major browser vendors. Assuming the W3C committee voted down the EME standard, at this late point in the game and with no competing standard to satisfy the use case, what stops Google, Mozilla, Apple, and Microsoft from just implementing the standard as-drafted without the W3C's sign-off? At that point, the browsers will be enabling functionali…

Nothing stops them, and in fact each of the major browsers have already implemented EME.

Chrome has been using EME with Netflix since early 2013. This fight was lost years ago.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#26

Post by __jal » Fri, Jul 07, 2017, 8:09 PM UTC

II2II wrote: post #17

Everything that I have read suggests that this is standardizing what has already happened with video, which is a great deal better than the bad old days when companies relied upon Macromedia/Adobe for video streaming. (Or worse, a plug-in from an obscure company with an unknown track record). As much as I would like to avoid DRM, relatively few producers are going to budge on the issue. The only options are standardi…

I disagree. "Doing without" seems the most sensible to me.

There is no rule that industries whose business is built on copyright need to be able to live in the browser. Netflix demonstrated that quite nicely. Just because the want it doesn't mean they should get it. I personally cripple EME on my browsers, and if your content won't display for me, I'll happily go elsewhere. (Haven't had the problem yet, but fully expect to.)

It is bad enough, but unsurprising, that the closed browsers would go along with user-hostile bullshit like this. That Mozilla did, I find appalling.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#27

Post by TheAceOfHearts » Fri, Jul 07, 2017, 8:15 PM UTC

EME is useless garbage. It's one of the first things I disable when I install Firefox. I can't do much, but I boycott any service that uses it.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#28

Post by 4bpp » Fri, Jul 07, 2017, 8:17 PM UTC

II2II wrote: post #17

Everything that I have read suggests that this is standardizing what has already happened with video, which is a great deal better than the bad old days when companies relied upon Macromedia/Adobe for video streaming. (Or worse, a plug-in from an obscure company with an unknown track record). As much as I would like to avoid DRM, relatively few producers are going to budge on the issue. The only options are standardi…

The standard argument against this says that while every bug, security breach and inconvenience that arises due to the alternative (non-standardised, proprietary DRM, or no in-browser DRM at all) may individually make engineers thinking about the system from an engineering standpoint break out in hives, the discomfort will also be felt by end users and associated with DRM, therefore serving as an obstacle to its public acceptance and proliferation.

As a relevant comparison, I think the current situation with the plethora of proprietary video game DRM solutions that are universally recognised to be terrible is strictly preferable to an alternative world in which video game DRM Just Works™, possibly with hardware support: in no small part thanks to it, we have a healthy amount of pressure on game studios to hold back and a market for DRM-free publishers such as GOG, and perhaps more controversially a healthy piracy ecosystem to punish the worst actors in the market.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#29

Post by eveningcoffee » Fri, Jul 07, 2017, 8:27 PM UTC

I think all people who think that this will end with media only are naive. Next step is DOM.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#30

Post by problems » Fri, Jul 07, 2017, 8:29 PM UTC

eveningcoffee wrote: post #29

I think all people who think that this will end with media only are naive. Next step is DOM.

Let's encrypt the DOM in our open source browser... wait what?

EME is pretty great for cracking too - they enable rendering with the browser's own video engine, giving you a nice "hook to dump pre-decoded frame here" point.